CrowdStrike Updated CCFR-201b Exam Questions and Answers by goldie

It contains the TargetProcessld_decimal value for other related events

It contains an internal value not useful for an investigation

It contains the ContextProcessld_decimal value for the parent process that made the DNS request

It contains the TargetProcessld_decimal value for the process that made the DNS request

Graph View

Tree View

Process Timeline

List View

Global (applies to all hosts in the environment)

Only the specific host where the file was originally quarantined

All hosts within the same host group as the source host

All hosts running the same operating system version

Create a Quarantine Rule that will quarantine all identified artifacts across the entire environment

Create Custom IOA rules to prevent the execution of these artifacts

Create a workflow to trigger on a new endpoint detection, query the telemetry data of the endpoint for known artifacts, and select Remove All Associated Artifacts as an action

Create a workflow to trigger on a new endpoint detection, conditions that match the detection, and as an action a PowerShell script to kill associated processes and remove all artifacts